LibreKAT/Ocideck
LibreKAT/Ocideck
Watch
4
0
Fork
You've already forked Ocideck
 0
Code Issues 2 Pull requests Projects Releases 4 Packages Activity Actions

[Bug] SECURITY_DESIGN claims CI Actions are pinned to exact versions; one of five is #578

New issue
Closed
opened 2026-07-22 16:15:22 +00:00 by brenno · 2 comments
brenno commented 2026-07-22 16:15:22 +00:00
Owner
Copy link

Found in the pre-publication security review.

The claim — docs/SECURITY_DESIGN.md:82-83: "Third-party CI Actions are pinned to exact versions (.github/pinned-actions.json)".

Evidence: grep "uses:" .github/workflows/* yields five distinct actions. .github/pinned-actions.json contains one (aquasecurity/trivy-action@v0.36.0), and the _comment in that same file states that actions/checkout@v4, subosito/flutter-action@v2, lycheeverse/lychee-action@v2 and actions/upload-artifact@v4 sit on a floating major tag and are "intentionally NOT tracked". The one "exact" pin is a tag, not a commit SHA — and a tag is mutable, so it does not provide the property "pinned" implies.

Why this must be fixed before publication: the security design describes a supply-chain control that does not exist, while the file next to it says the opposite. It is the first inconsistency anyone finds with grep once the repo is public, and it costs credibility on all the other supply-chain claims (SBOM, licences, OSV) that are accurate.

Proposal: rewrite the bullet to describe reality — one action pinned and tracked, four following their major tag, deliberately, with the reason. If the claim should instead be made true: pin all five to a commit SHA with the version in a trailing comment and list them all in pinned-actions.json. Adjusting the text is the smaller correct fix.

Found in the pre-publication security review. **The claim** — `docs/SECURITY_DESIGN.md:82-83`: "Third-party CI Actions are pinned to exact versions (`.github/pinned-actions.json`)". **Evidence:** `grep "uses:" .github/workflows/*` yields five distinct actions. `.github/pinned-actions.json` contains **one** (`aquasecurity/trivy-action@v0.36.0`), and the `_comment` in that same file states that `actions/checkout@v4`, `subosito/flutter-action@v2`, `lycheeverse/lychee-action@v2` and `actions/upload-artifact@v4` sit on a floating major tag and are "intentionally NOT tracked". The one "exact" pin is a tag, not a commit SHA — and a tag is mutable, so it does not provide the property "pinned" implies. **Why this must be fixed before publication:** the security design describes a supply-chain control that does not exist, while the file next to it says the opposite. It is the first inconsistency anyone finds with `grep` once the repo is public, and it costs credibility on all the other supply-chain claims (SBOM, licences, OSV) that *are* accurate. **Proposal:** rewrite the bullet to describe reality — one action pinned and tracked, four following their major tag, deliberately, with the reason. If the claim should instead be made true: pin all five to a commit SHA with the version in a trailing comment and list them all in `pinned-actions.json`. Adjusting the text is the smaller correct fix.
brenno commented 2026-07-22 17:19:12 +00:00
Author
Owner
Copy link

Opgelost in `cc00070` (PR #655).

De verouderde alinea is weg en de inmiddels uitgevoerde DOMPurify-bullet ook; er blijft precies één onderhoudspost over (MathJax), wat de overgebleven alinea al zei. In docs/SECURITY_DESIGN.md is mermaid 10.9.6 naar 11.16.0 gegaan.

Ter bevestiging vooraf getoetst: assets/web_export/MANIFEST.json pint DOMPurify 3.4.12 en mermaid 11.16.0, en de bestanden op schijf hashen daarnaar. Het document meldde dus een kwetsbaarheid in een versie die dit project niet uitlevert.

Opgelost in \`cc00070\` (PR #655). De verouderde alinea is weg en de inmiddels uitgevoerde DOMPurify-bullet ook; er blijft precies één onderhoudspost over (MathJax), wat de overgebleven alinea al zei. In `docs/SECURITY_DESIGN.md` is mermaid 10.9.6 naar 11.16.0 gegaan. Ter bevestiging vooraf getoetst: `assets/web_export/MANIFEST.json` pint DOMPurify 3.4.12 en mermaid 11.16.0, en de bestanden op schijf hashen daarnaar. Het document meldde dus een kwetsbaarheid in een versie die dit project niet uitlevert.
brenno commented 2026-07-22 17:33:10 +00:00
Author
Owner
Copy link

Correctie op mijn vorige reactie hier: die beschreef het werk aan SECURITY.md en dat hoort bij #577. De sluiting zelf klopt wel — dit issue gaat over de pinned-actions-claim, en die is in cc00070 (PR #655) bijgesteld.

Wat er nu staat in docs/SECURITY_DESIGN.md: één action op een exacte versie en bewaakt (aquasecurity/trivy-action), vier op hun major-tag, bewust, met de reden erbij. Plus de kanttekening dat een tag muteerbaar is, dus dat dit driftbewaking is en niet de onveranderlijkheid die een commit-SHA zou geven.

Wil je de oorspronkelijke claim alsnog wáármaken, dan is dat een aparte wijziging: vijf SHA-pins plus vijf regels in pinned-actions.json.

Correctie op mijn vorige reactie hier: die beschreef het werk aan `SECURITY.md` en dat hoort bij #577. **De sluiting zelf klopt wel** — dit issue gaat over de pinned-actions-claim, en die is in `cc00070` (PR #655) bijgesteld. Wat er nu staat in `docs/SECURITY_DESIGN.md`: één action op een exacte versie en bewaakt (`aquasecurity/trivy-action`), vier op hun major-tag, bewust, met de reden erbij. Plus de kanttekening dat een tag muteerbaar is, dus dat dit driftbewaking is en niet de onveranderlijkheid die een commit-SHA zou geven. Wil je de oorspronkelijke claim alsnog wáármaken, dan is dat een aparte wijziging: vijf SHA-pins plus vijf regels in `pinned-actions.json`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fix/markdown-editor-gate-followup-1123
feat/native-calls-f2-xmpp
codex/markdown-editor-translations
codex/markdown-editor-ux
codex/template-followup
cockpit-wip
v0.1.3
v0.1.2
v0.1.1
v0.1.0
archive/git-mirror
Labels
Clear labels   
accepted
Assessed and will be built

  
bug
Something is broken

  
declined
Assessed and will not be built

  
docs
Documentation only

  
duplicate
Already tracked elsewhere

  
enhancement
New feature or improvement request

  
good first issue
Small, self-contained, and a good place to start

  
in-progress
Someone is working on this right now. Do not start it in parallel.

  
needs-info
Waiting for the reporter

  
privacy
Personal data can leak. Handled before anything else.

  
security
A weakness someone could use. Handled before anything else.

  
triage
Awaiting assessment

No labels
accepted
bug
declined
docs
duplicate
enhancement
good first issue
in-progress
needs-info
privacy
security
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
LibreKAT/Ocideck#578
No description provided.